Unified Diff » Linux

FUSE Extension for PHP

Bob — Tue, 16 Dec 2008 01:24:03 +0000

Well, it’s official… I’m a geek. A few weeks ago I started writing an extension for the PHP runtime that provides bindings to libfuse. Back up a few months— I wrote a PHP script to screen-scrape the Trac web interface and allow me to grab source code to a project I’m working on.

My solution worked but it was pretty ugly. So I wondered if it would be better to implement a FUSE file system to do the same task. Unfortunately PHP didn’t have bindings for libfuse at the time. After several failed attempts at using SWIG to automagically generate an extension, I came to the harsh realization that if I wanted FUSE bindings I’d have to do it myself. I mean… how hard could it be?

It actually wasn’t too bad. I read a bunch of non-existent documentation on the Zend API and went to work on a prototype. It took me about a week, but I now have a working PHP extension. I’ve also since implemented TracFS to replace my ugly script.

I’m almost finished with writing the documentation for the PHP website. To build the extension, you have to check out the sources from CVS.

$ svn co http://svn.php.net/repository/pecl/fuse/trunk/ php_fuse
$ cd php_fuse && phpize
$ ./configure
$ make && sudo make install

You’ll need to install PHP and FUSE (or MacFUSE) before you can build the extension. Once everything is installed, you can test php_fuse with the scripts in pecl/fuse/examples. For now, the extension does not support writing files, only reading. Sometime in the near future I will implement the rest of the VFS callbacks.

Building Amarok 1.4 on Leopard

Bob — Mon, 30 Jun 2008 18:02:39 +0000

I love Amarok and wanted to install it on my MacBook. With Qt4 on the horizon, it will be possible to run Amarok natively in OS X without an X server. But I didn’t want to wait for Amarok2 to become stable, so I looked into compiling Amarok 1.4 and running it under X.

I tried following the On OS X guide with limited success. Apparently, ffmpeg won’t compile on Leopard and that caused the entire libxine compilation to fail. I tried various combinations of configure flags, but none seemed to help. I looked at the source to try and fix it, but unfortunately I’m not terribly familiar with x86 assembly.

The problem code had to do with video rendering, so since Amarok doesn’t use it I just cut it out of the build process. Edit src/combined/ffmpeg/Makefile and find

xineplug_LTLIBRARIES = xineplug_decode_ff.la xineplug_decode_dvaudio.la

and replace with

xineplug_LTLIBRARIES = xineplug_decode_dvaudio.la

After that, edit src/post/Makefile and find

SUBDIRS = planar goom visualizations mosaico deinterlace audio

and replace with

SUBDIRS = goom visualizations mosaico audio

Now libxine will build.

With libxine installed, I had a few more steps to build Amarok. I installed taglib

$ sudo fink install taglib

I also had to specify the location of the OpenGL framework I wanted to use

LDFLAGS="-Wl,-dylib_file,/System/Library/Frameworks/OpenGL.framework/Versions/ \
  A/Libraries/libGL.dylib:/System/Library/Frameworks/OpenGL.framework/Versions/ \
  A/Libraries/libGL.dylib"

And finally, this is how I configured Amarok

./configure --prefix=/sw --with-qt-includes=/sw/include/qt \
  --with-qt-libraries=/sw/lib/qt3/lib

I now have Amarok successfully compiled and running on Leopard. This took me quite a bit of time to get right, so I’m hoping someone else will find it useful.

HOW TO: Samba as an AD Domain Member

Bob — Thu, 05 Oct 2006 01:30:55 +0000

There are probably a million and one articles about how to make Samba 3 an Active Directory domain member. But with all of that, this process still seems to require hours of research. So I’ve decided to compile my latest experiences here.

The domain member box is running Gentoo Linux. So you may need to adjust the steps to fit your flavor. Make sure the USE flags kerberos, ldap, samba, ssl, and winbind are set. Start by installing an NTP client.

# emerge ntp

The purpose of NTP is to keep your computer’s clock in-sync with the domain controller. Edit your /etc/ntp.conf file to use your domain controller as the time server. Then sync your clock, start the NTP client, and install Samba:

# ntpdate ad01.rit.edu
# /etc/init.d/ntpd start
# rc-update add ntpd default
# emerge samba

Now you can configure kerberos. Open your /etc/krb5.conf file and make it look like this:

[libdefaults]
  ticket_lifetime = 600
  default_realm = RIT.EDU
  clockskew = 120

[realms]
  RIT.EDU = {
    kdc = ad01.rit.edu
    default_domain = RIT.EDU
  }

[domain_realm]
  .rit.edu = RIT.EDU
  rit.edu = RIT.EDU

Test your kerberos setup by requesting a ticket from your domain controller.

# kinit administrator
# klist
# kdestroy

Edit your Samba configuration.

[global]
  workgroup = RIT
  realm = RIT.EDU
  server string =

  log file = /var/log/samba/log.%m
  max log size = 50

  hosts allow = 127.0.0.1 129.21.0.0/16   
  hosts deny = 0.0.0.0/0
  security = ADS
  allow trusted domains = yes
  password server = ad01.rit.edu
  encrypt passwords = yes
  min protocol = NT1

  winbind enum users = yes
  winbind enum groups = yes
  winbind cache time = 600
  winbind use default domain = yes
  template homedir = /home/%U
  obey pam restrictions = yes
  template shell = /bin/bash

  socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
  domain master = no
  local master = no

  idmap uid = 10000-99999
  idmap gid = 10000-99999

Add winbind to the daemon_list variable in /etc/conf.d/samba.

daemon_list="smbd nmbd winbind"

Join the domain and start Samba.

# net ads join -U administrator
# /etc/init.d/samba start

Add winbind to the passwd and group lines in /etc/nsswitch.conf.

passwd:      compat winbind
shadow:      compat
group:       compat winbind

Test user resolution and add Samba to the startup:

# getent passwd administrator
# rc-update add samba default

Add the bolded lines to your /etc/pam.d/system-auth file.

auth required pam_env.so
auth sufficient	pam_winbind.so
auth sufficient	pam_unix.so likeauth nullok use_first_pass
auth required pam_deny.so

account	required pam_access.so
account	sufficient pam_winbind.so
account	required pam_unix.so

password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so

session	required pam_limits.so
session	required pam_unix.so
session required pam_mkhomedir.so

That’s it! Now all you need to do is start samba and your box is an AD domain member.

Active Directory and Linux

Bob — Sat, 17 Jun 2006 03:47:50 +0000

I maintain several client and server machines that, up until recently, all authenticated users locally. I wanted a more centralized mechanism that could handle the various users and systems on the network. The big catch is that a few key system run Linux while others run Windows. So after doing some research, I turned to Active Directory.

My first chore was to install Windows Server 2003 and configure it to be a domain controller. This part was fairly easy, although a little time-consuming. Once that was working I was able to quickly join the Windows machines to the domain. Now to deal with Linux… for that I chose Windows Services for Unix. This software alters the AD schema to allow for Unix account attributes. On the Linux machines, I installed OpenLDAP, a Kerberos client, configured PAM… and voila! Now AD users can authenticate on the Linux machines.

My home-made DHCP/DNS configuration tool, however, was a little trickier. The data for this tool is stored in a MySQL database and accessed via a PHP script. If I wanted to grant someone access to the tool, I needed to first give them a MySQL account. Since Active Directory is basically an LDAP server, I rewrote the authentication mechanism to query AD.

With very little work, I was able to simplify authentication and account management. While this is not new technology, I still feel all warm and fuzzy with a sense of accomplishment.